Windows Event Log Cleared via wevtutil, Clear-EventLog, or Event ID 1102

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•6

Detects attempts to clear Windows Event Logs using either the command-line utility 'wevtutil.exe' or the PowerShell cmdlet 'Clear-EventLog'. Additionally, it monitors for Windows Security Event ID 1102, which specifically indicates the clearing of the Security log. These actions are common indicators of an adversary attempting to remove evidence of their activity from a host system.